J25-066_852571918_TCA JA_Final_Redacted.pdf

CUI

Controlled by: USTR Controlled By: TCJ6 CUI Category: OPSEC, SSEL, PROCURE, BUDG Distribution/Dissemination Control: FED ONLY

POC: AMY STANFILL, +1 6188174388, AMY.J.STANFILL.CIV@MAIL.MIL

JUSTIFICATION & APPROVAL FOR FEDERAL ACQUISITION

REGULATION SUBPART 16.5 ACQUISITIONS

EXCEPTION TO FAIR OPPORTUNITY

Multiple Award Contract

Orders under Fair Opportunity Federal Acquisition Regulation (FAR) 16.505(b), Defense FAR Supplement 216.505-(b), Procedures, Guidance, and Information (PGI) 216.505-(b)

Military Interdepartmental Purchase Request Number: F3ST955058GC01 Joint Warfighting Cloud Capability (JWCC) Contract Number: HC105023D0003 Task Order (TO) Number: To be determined Procurement Title: United States Transportation Command (USTRANSCOM) Anywhere (TCA) Phase II

Statutory and Regulatory Authority: 10 United States Code (U.S.C.) 3204(a)(1) and FAR 16.505(b)(2)(i)(B)

EXCEPTION TO FAIR OPPORTUNITY

Number: J25-066

Upon the basis of the following justification, I, as the Procuring Activity Competition Advocate (PACA), hereby approve this exception to fair opportunity pursuant to the Statutory Authority of 10 U.S.C. 3204(a) and Regulatory Authority of FAR 16.505(b)(2)(i)(B).

1. REQUESTING AGENCY AND CONTRACTING OFFICE:

Requesting Agency:

USTRANSCOM / TCJ6 Command, Control, Communications and Cyber Systems 508 Scott Dr, B1961 Scott AFB, IL 62225

Contracting Activity:

Defense Information Systems Agency (DISA) / Defense Information Technology Contracting Organization (DITCO) / Cloud Capabilities Section (PS8511)

2300 East Drive Scott Air Force Base, IL 62225-5406

2. NATURE/DESCRIPTION OF ACTION(S):

This action is to issue a firm-fixed-price TO against the JWCC Indefinite Delivery/Indefinite Quantity Contract for TCA Phase II. This TO will be issued directly to Microsoft Corporation.

The anticipated period of performance is for a 1-year base period. The total estimated value is which will be funded by Working Capital funds.

J25-066 - TRANSCOM Anywhere (TCA) Phase II

Page 2 of 8 Pages

3. DESCRIPTION OF SUPPLIES/SERVICES:

USTRANSCOM, driven by the Department of Defense (DoD) Chief Information Officer (CIO) Zero Trust mandate, is modernizing its office information systems by transitioning to a software as a service (SaaS) environment that meets the requirements of this mandate. This strategic shift aims to reduce the burden of tooling overhead for testing and maintenance of enterprise services while simultaneously achieving DoD-mandated Zero Trust compliance. Leveraging a suite of tools within a single Cloud Service Provider (CSP) ecosystem will facilitate this Zero Trust implementation, ultimately fostering a more secure and streamlined information technology infrastructure for USTRANSCOM. This modernization effort will enable a more efficient and robust security posture by consolidating resources and streamlining management within a cohesive Microsoft environment.

4. SUPPORTING RATIONALE, INCLUDING A DEMONSTRATION THAT THE

PROPOSED CONTRACTOR’S UNIQUE QUALIFICATIONS OR THE NATURE OF THE

ACQUISITION REQUIRES USE OF AN EXCEPTION TO FAIR OPPORTUNITY:

(a) Exception to Fair Opportunity.

FAR 16.505(b)(2)(i)(B) - Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.

(b) Description of the Justification.

USTRANSCOM's operational network suite is built within the Microsoft suite of cloud offerings and services. This ongoing multi-year project remains strategically essential due to the integration of Microsoft technologies; Microsoft Azure Defender, Microsoft Sentinel, Microsoft 365 Defender and Microsoft Intune that are services already under use within the TCA environment. Use of another CSP’s environment would create unacceptable disruptions and impacting mission-critical operations. With the current infrastructure integration with Azure Cloud Services, the Windows operating system, and the broader Microsoft Software Suite, replicating this ecosystem with another CSP would be incredibly complex, and would introduce significant technical challenges and delays in delivering the capability. This integration is crucial for security patching, software updates, and overall endpoint security posture. Moreover, USTRANSCOM benefits from premium support through the "Microsoft Blue Badge Cardholder-support" program, providing direct access to Microsoft experts, ensuring rapid issue resolution, and proactive security management. This specialized support is critical for maintaining system stability and would be difficult to replicate elsewhere.

While recognizing the long-term value of competition, the current situation necessitates a continued approach with Microsoft to ensure mission continuity and maximize existing investments. Leveraging the existing Microsoft ecosystem allows USTRANSCOM to

Page 3 of 8 Pages

CUI

capitalize on these pre-built integrations and benefit from a unified security posture and streamlined management experience.

(c) Justification.

(1) Minimum Government requirements.

The DoD CIO's mandate for Zero Trust security architecture is a critical requirement for USTRANSCOM. Achieving this mandated requirement necessitates leveraging key technologies and aligning with strategic cybersecurity approaches. Several of the DoD's Zero Trust objectives rely on Microsoft Entra Identity (ID) (formerly Azure Active Directory), which is a critical SaaS product for user-level security and auditing within a Zero Trust environment. Microsoft Entra ID's capabilities include identity and access management, conditional access policies, and multi-factor authentication which are essential for enforcing least-privilege access and continuous verification, all of which are core tenets of Zero Trust. This specific SaaS product is a critical component for meeting mandatory DoD security objectives. Microsoft Entra ID is essential in reinforcing the approach to cybersecurity within USTRANSCOM that streamlines and integrates efficiencies in a secure cloud environment that meets the DoD’s Zero Trust requirement.

The required cloud offerings must meet the DoD CIO's mandate for Zero Trust security and must seamlessly integrate with Microsoft Entra ID or fully replicate the combined functionality of Microsoft Entra ID.

(2) Proposed sole source contractor.

Microsoft Corporation

(3) Discussion regarding the cause of the sole source situation.

USTRANSCOM's current Identity, Credential, and Access Management (ICAM) implementation is deeply integrated with Microsoft Entra ID, making this specific SaaS a critical component of its functionality. Adapting the core ICAM solution to another CSP does not meet the Government’s requirement since it would entail significant re-engineering and refactoring within the unique Microsoft Entra ID environment. In addition, there would be duplication of costs associated with running parallel solutions on two separate platforms. This integration extends to endpoint configuration management, ensuring consistent security policies and access controls are enforced across all devices.

Microsoft Entra ID provides critical security features essential to protecting sensitive data and ensuring operational integrity, including multi-factor authentication, single sign-on, and conditional access policies, which form the core of USTRANSCOM’s posture. This tight coupling with endpoint configuration allows for granular control over device access based on identity and compliance status.

Migrating away from or refactoring the existing Microsoft Entra ID-based ICAM environment, including its integration with endpoint configuration, presents insurmountable challenges in terms of complexity, cost, and risk. This environment

Page 4 of 8 Pages

CUI

cannot be replicated with another CSP without requiring extensive system reconfiguration, complex data migration across the network configuration, and rigorous testing to validate functionality and security. This introduces unacceptable risk to the Government. Furthermore, transitioning away from the current Microsoft Entra ID solution would introduce substantial delays in critical modernization efforts, effectively duplicating costs by necessitating the parallel development and maintenance of a separate identity infrastructure.

(4) Demonstration of unique source.

Microsoft is the only source capable of delivering the TCA capability at the required level and quality while simultaneously fulfilling the DoD's Zero Trust mandate. This is due to several factors:

TCA's requirement of Microsoft’s Entra ID: TCA's success relies on functionalities exclusively provided by Microsoft's Entra ID, which serves as the foundation for USTRANSCOM's Zero Trust framework. Microsoft Entra ID provides critical ICAM services—a network-critical function not currently met by any of the other three CSPs.

Unique Expertise and Support: Microsoft possesses the necessary knowledge, skills, certifications, clearances, and experience to ensure seamless continuation of the program without disruption to critical network services. Furthermore, Microsoft's "Blue Badge Cardholder support" provides direct access to product developers, offering unparalleled support for proprietary products crucial to USTRANSCOM's infrastructure.

Given these factors, Microsoft is the only CSP capable of meeting the stringent ICAM requirements necessary for the USTRANSCOM to achieve DoD-mandated Zero Trust with USTRANSCOM’s current environment. This makes continued use of the Microsoft’s cloud service offerings essential for mission success.

(5) Procurement discussion.

USTRANSCOM is congressionally mandated by the DoD CIO to use the Defense Enterprise Office Solution (DEOS) contract vehicle for cloud-based licensing which provides centralized user account licensing. The security of Microsoft user account licenses is uniquely dependent on Microsoft Entra ID security offerings, which is proprietary to Microsoft. The integration between DEOS, user account licensing, and Entra ID security are only available through Microsoft and cannot be readily replicated by any of the other three CSPs. Using multiple components would introduce significant security risks and potentially violate the congressional mandate for utilizing DEOS.

Moreover, Microsoft is the only CSP capable of meeting the continued need of the TCA modernization requirement. Based on the Additional Market Research request to the four JWCC CSPs on April 18, 2025, the only CSP that can meet the minimum needs of the

Page 5 of 8 Pages

CUI

Government is Microsoft. Microsoft is the only source able to fully replicate the combined functionality of Microsoft Entra ID.

(6) Impact.

Migration to another CSP is not feasible and would cripple USTRANSCOM's compliance with the DoD mandated Zero Trust efforts. This would result in resetting the project, add a minimum of two years, and delay network critical ICAM services. The potential delays in not complying with the DoD mandated Zero Trust target levels presents a risk for USTRANSCOM cybersecurity vulnerabilities and exploitation, which could result in a break in enterprise services.

5. COST/PRICE FAIR AND REASONABLE DETERMINATION:

A determination that the price is fair and reasonable will be based on a comparison of the contractor’s proposal to the Independent Government Cost Estimate and the JWCC Catalog pricing, including any discounts, which was previously found to be fair and reasonable and based on the contractor’s commercial pricing.

6. MARKET RESEARCH:

Market research for the basic JWCC Contracts was conducted and resulted in a signed market research report on November 9, 2021, that was revalidated and recertified on July 29, 2024.

After a survey of the market, it was concluded that use of the JWCC Contract is in the Government’s best interest due to technical feasibility and cost to the Government.

Additional research was conducted March 3, 2025, through April 18, 2025, by reviewing JWCC catalog offerings and thoroughly reviewing Amazon Web Service (AWS) offerings. The USTRANSCOM requested Additional Research to Support Fair Opportunity from all four JWCC CSPs to identify potential vendors capable of fulfilling the government's minimum requirements for this critical project. This research aimed to explore the availability of alternative solutions and avoid sole-source dependency. However, after a thorough evaluation of responses and capabilities, the research concluded that only Microsoft currently possesses the necessary combination of technologies, infrastructure, security posture, and expertise to meet the stringent demands of this specific project. Four CSPs responded to the request. However, Microsoft was the only contractor able to fully replicate the combined functionality of Microsoft Entra ID (formerly Azure Active Directory). Microsoft 365 Government G5 licensing capabilities, and the DEOS contract licenses provided under the G5 offering. Because the G5 bundle represents a carefully optimized package of licensing, features, and support specifically designed for government agencies, replicating this precise configuration through another CSP is complex and potentially costly. Even if the necessary licenses had already been purchased, CSPs generally lack the specific authorization, infrastructure, and expertise to deliver the specialized services associated with the G5 offering, making a complete replication infeasible. While some CSPs may offer partial solutions, only Microsoft is capable of meeting the Government’s minimum requirements.

Page 6 of 8 Pages

CUI

USTRANSCOM consulted with individuals experienced in Government cloud acquisitions and serverless architecture who provided valuable information on current market trends and best practices. USTRANSCOM also reviewed Gartner's Magic Quadrant articles for Cloud Infrastructure and Platform Services, as well as Forrester's Wave report on Public Cloud Platforms. These reports provided a comparative analysis of various CSPs and their offerings, allowing for a comprehensive understanding of the competitive landscape. USTRANSCOM conducted researched in Sam.gov to identify recent solicitations related to cloud services and reviewed the General Services Administration's (GSA) eLibrary for existing contract vehicles suitable for cloud acquisitions. USTRANSCOM also examined AWS's online documentation for their various cloud services, including Amazon compute and store Elastic Cloud Compute (EC2), Simple Storge Service (S3), and Lambda, and reviewed Azure's product pages for comparable services. The Government researched the DISA milCloud 2.0 contract and explored the availability of cloud services through the GSA Multiple Award Schedule. This helped determine the feasibility of leveraging existing contracts for the acquisition of cloud services.

USTRANSCOM participated in a webinar on cloud security best practices hosted by the Cloud Security Alliance and attended a virtual conference on the future of cloud computing. These sessions provided valuable insights into emerging security challenges and future trends in the cloud market. This market research confirmed that Microsoft is the only vendor capable of meeting the Government’s minimum requirements.

7. ANY OTHER SUPPORTING FACTS:

USTRANSCOM’s mandated Zero Trust Framework implementation is dependent upon Microsoft Entra Identity.

8. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FAIR OPPORTUNITY:

(a) Procurement History:

Incumbent Contractor: Microsoft Contract Number: HC105023D0003 Task Order Number: HC105024F0020 Period of Performance: June 6, 2024 - June 5, 2025 Competitive Status: Other than full and open competition Business Size: Large business

(b) To support HC105023D0003/HC105024F0020, a justification and approval (J&A) for an exception to fair opportunity was signed on May 1, 2024, by the PACA. The previous J&A was based upon an exception to fair opportunity FAR 16.505(b)(2)(i)(B), only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.

Despite extensive market research and technical evaluations focused on identifying commercially available ICAM services that meet USTRANSCOM's stringent performance criteria, a fully equivalent alternative to Microsoft Entra ID has not been identified at this time. As the previous J&A noted, USTRANSCOM's continued use of

Page 7 of 8 Pages

CUI

Microsoft Entra ID is driven by the absence of ICAM services meeting those specific criteria. Our market research explored Oracle's, Google's, and AWS's ICAM offerings, analyzing their ability to provide comparable security features, seamless integration with our existing infrastructure, and support for our established workflows. As stated in the previous J&A, to overcome future barriers to competition, the Government intends to continue conducting market research and assessments for CSPs' emerging technologies possessing authorized impact levels and security capabilities required for specific Government systems and information. This ongoing market research will continue to prioritize identification of ICAM solutions that meet our performance criteria. Even with containerization, alternative ICAM solutions have not yet demonstrated the technological ability to meet USTRANSCOM’s specific performance, security, and integration requirements. USTRANSCOM's continued use of Microsoft Entra ID is driven by the absence of commercially available ICAM services that meet the performance criteria.

USTRANSCOM remains committed to continuous market research, regularly assessing emerging technologies and capabilities from various CSPs. Of particular importance is evaluating CSPs that possess authorized Impact Levels (ILs) and security standards required for sensitive government systems. Additionally, investing in the development and enhancement of Infrastructure as a Service (IaaS) components, specifically by transitioning to a containerized platform, is crucial. This approach will enable multiple CSPs to meet government requirements, fostering competition and allowing for workload shifts based on evolving financial and mission needs.